OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
Moderate severity
GitHub Reviewed
Published
Nov 27, 2023
in
oroinc/orocommerce
•
Updated Dec 4, 2023
Package
Affected versions
>= 4.2.0, <= 4.2.8
>= 5.0.0, < 5.0.11
>= 5.1.0, < 5.1.1
Patched versions
5.0.11
5.1.1
Description
Published to the GitHub Advisory Database
Nov 27, 2023
Reviewed
Nov 27, 2023
Published by the National Vulnerability Database
Nov 28, 2023
Last updated
Dec 4, 2023
Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks.
References